Fix-mode `--json` reports a `sha-as-ref` warning for a ref the same run just rewrote to a tag

Aberta
  • Algo errado?
#276 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@Okabe-Junya já está trabalhando nisso.

Desde 8/11/2026.

  • #277 de @Okabe-Junya — aberto

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
35/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Estagnada
Stack de tecnologia
github-actions, go
Domínio
cli, security

Direção de pesquisa

Start by tracing how --json=valid,findings gathers sha-as-ref findings and how the default fix run rewrites workflow uses: lines; the issue does not name implementation files or tests. Reproduce with the supplied workflow and compare the first run's JSON findings with the rewritten line and terminal summary. Done when the first run's JSON no longer reports a warning for the SHA it replaced; linked pull request #277 is already open.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

What happened

A default fix run that rewrites uses: owner/repo@<sha> # vX.Y.Z to uses: owner/[email protected] still emits a sha-as-ref warning in its --json output, keyed by the SHA that is no longer in the workflow.
The remediation says "pin to a tag instead", which is what the run just did. A second run reports nothing. The terminal summary of the same run shows no warning.

Steps to reproduce
mkdir repro && cd repro && git init -q
mkdir -p .github/workflows
cat > .github/workflows/ci.yml <<'EOF'
name: ci
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
EOF
gh actions-lock --no-interactive --json=valid,findings 2>/dev/null

First run output (workflow now reads uses: actions/[email protected]):

{
  "cli_version": "v0.4.1",
  "findings": [
    {
      "workflow": ".github/workflows/ci.yml",
      "category": "sha-as-ref",
      "severity": "warning",
      "confidence": "high",
      "dependency": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
      "detail": "pinned to a bare SHA without a symbolic ref — weakens supply-chain traceability",
      "remediation": "pin to a tag instead: https://github.com/actions/checkout/releases",
      "doc_url": "https://github.com/github/gh-actions-lock/blob/main/docs/troubleshooting.md#sha-as-ref"
    }
  ],
  "lockfile_version": "v0.0.3",
  "valid": true
}

Second run of the same command: "findings": [].

Same first run without --json prints only the pin summary, no warning:

Scanning 1 workflow
Planning pins
Pinned 1 action across 1 workflow
  actions/[email protected] (3d3c42e)
    └─ .github/workflows/ci.yml

With --no-narrow the workflow is left as written and the warning is accurate, so this only affects the default rewrite path.

Expected

Post-fix JSON should not carry a warning whose subject the write removed. Either drop warnings the fix resolved, or re-evaluate sha-as-ref against the rewritten uses: lines.

Environment
  • gh-actions-lock v0.4.1 (gh extension install github/gh-actions-lock --pin v0.4.1), lockfile schema v0.0.3
  • gh 2.x on macOS 26 (arm64), github.com
Linguagem predominante
Go
Estrelas
317
Forks
24
Merge médio
1d 8h
PRs com merge (30d)
50

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de github/gh-actions-lock

Todas as issues de github/gh-actions-lock

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.